as we always pass in all of them in a well defined order
Test: TreeHugger, manually
Flag: EXEMPT mainline
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I93c4a9883983645cbe7d11101aa749dc2faf9d6d
Maciej Żenczykowskicommited 2025-08-05 12:15:03 -07:00
32-bit x86 has a crazy networking calling convention and instead of using
individual system calls has a single multiplexed socketcall()
bionic hasn't finished transitioning to the individual calls yet
which were added to Linux kernels around the 4.10-4.14-ish timeframe.
This does open a bit of security hole, since it effectively allows
all 20-ish networking system calls, but oh well, better than constantly
allowing & logging.
I don't think we'll ever want to enable KILL mode on x86-32 any way.
Test: TreeHugger
Flag: EXEMPT mainline & disabled code
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I7228132cfbf716592607d010f64d5adeeb4419aa
Maciej Żenczykowskicommited 2025-08-05 12:14:42 -07:00
This is a *critical* fix for http://go/aog/3514294
'Drop egress multicast on clat interface'
Bug: 404457155
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: If14ef730f78c7e991842a678260dd20df607b1ec
Maciej Żenczykowskicommited 2025-03-21 12:55:32 -07:00
but only enable it in enforcing mode on aarch64,
since that gets good test coverage via Pixel
on GoogleGuest ipv6-only wifi network
and (for example) T-Mobile US cellular.
For other architectures this will only result
in (automatically ratelimitted to at most 5/s)
audit logs for any 'unusual' system calls.
Test: TreeHugger, manually on Pixel on GoogleGuest wifi
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id14c6d9db8d7b4652c7358cac101a82ef09843e0
Maciej Żenczykowskicommited 2025-03-18 02:57:06 -07:00
Separate 'running' flag out into 'running' and 'sigterm',
and make SIGTERM handler the only thing that sets 'sigterm'.
running is cleared via catastrophic errors, ie. EOF and ENETDOWN
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I8254c3f4643d60feff1cb32aaa9784dca18e138c
Maciej Żenczykowskicommited 2025-03-17 22:53:32 -07:00
Multicast packets on the clat interface are not supported,
so drop them in both clatd and its associated bpf offload.
This is required because NsdManager will start sending mDNS
packets on the clat interface as the check for
IFF_POINTOPOINT was removed.
Ingress multicast packets are already dropped elsewhere.
Test: TH
Change-Id: Icd22ca7f263ea5ff5244c17276ebb1002f72e842
Conveniently, the C++ style "just don't name the argument if you're not going to use it" syntax is in C23. Inconveniently, given that this has already been by far the most troublesome C update ever, I'm assuming that the switch is likely to bounce, so this change goes with backwards-compatible syntax.
Change-Id: Ic67398042cb70c22a833b8bf8a745177a50dd9cd
This CL is created as a best effort to migrate test targets
to the new android ownership model. If you find incorrect or unnecessary
attribution in this CL, please create a separate CL to fix that.
For more details please refer to the link below,
<add g3 doc link>
Bug: 304529413
Test: N/A
Change-Id: I243f17b3f0ad7af9ffa15ca242456e36688733f5
Merged-In: I243f17b3f0ad7af9ffa15ca242456e36688733f5
(equivalent OWNERS file is already present in root directory of p/m/C)
Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I4a4da3cd13bcf4497a210aae44618681ed43fd64
Maciej Żenczykowskicommited 2023-09-12 11:48:34 -07:00
Maciej Żenczykowski
commited 
Patrick Rohr
commited 
Elliott Hughes
commited 
Aditya Choudhary
commited